## Why
The Responses API proxy could reuse a federated credential after an upstream `401`, and concurrent requests could each retry a failed token exchange.
## What changed
- Invalidate the rejected credential so the next request obtains a fresh token. Forward the `401` without replaying the request or waiting for an ongoing renewal; leave credentials intact on `403`.
- Track rejection per token issuance so a late `401` cannot invalidate a newer credential.
- Back off failed exchanges exponentially from 1 to 30 seconds, starting when the exchange fails. Reject requests during backoff without reusing the old token, and reset the delay after a successful exchange.
## Testing
Add tests for response forwarding without replay, late and concurrent rejections, shared renewal failures, backoff timing and reset, and credential-safe renewal errors without following redirects.
GitOrigin-RevId: eb1ed6848d74fdba1534919cace5126f4a0595cf
ee
54f99017f2